MATCH specification was totally ignoring the response so the test did
effectivelly nothing. Fixing MATCH clauses uncovered that delegations
were incorrect and that queries for localhost addresses have to be
allowed for the test to work. After that it turned out that NODATA proof
was not passing validation for some reason so I had to re-sign the zone.
The test was completely reworked to test:
- proper NODATA answer covered by wildcard
- NODATA answer missing NSEC record
- fake NODATA answer which replaces synthesized answer from wildcard